You Got Mail
Base Camp
Enumeration
Exploitation
Other Questions
Privilege Escalation
Root's flag
User's flag
Web Server
XSS
index
README

Web Server

#Attaking_Machine
Take a look at http://k2.thm.

There's nothing interesting. It seems a static website.

Subdomains

To enumerate potential subdomains use gobuster.

gobuster vhost -u http://k2.thm -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain

  • Add both domains to /etc/hosts.

Visit the subdomains

http://admin.k2.thm/

http://it.k2.thm/

Sing up on http://it.k2.thm/

  • Create an account on this server.
    • Username: Hack
    • Password: 123456

Next step: XSS